What is the CVSS score of CVE-2026-48356?

CVE-2026-48356 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 28.3%.

Which versions of Adobe Commerce are affected by CVE-2026-48356?

Adobe Commerce, Magento Open Source, and related platforms contain a critical file-upload vulnerability (CVE-2026-48356, CVSS 9.3) allowing account takeover and privilege escalation when users visit…

How to fix or mitigate CVE-2026-48356?

Within 24 hours, inventory all Adobe Commerce, Magento Open Source, B2B, and Webhooks Plugin instances; search web access logs and email systems for evidence of exploitation attempts or anomalous file uploads. Over the next 7 days, deploy network-level controls to restrict or monitor file upload endpoints, configure Web Application Firewall (WAF) rules to detect suspicious uploads targeting CVE-2026-48356, and establish logging and alerting for unusual access patterns. Within 30 days, monitor Adobe security advisories daily for patch release; develop and test patch deployment procedures for all affected systems; consider temporary operational restrictions (such as disabling customer-facing webhooks) on critical production instances until a vendor patch is released, validated, and deployed.

Adobe Commerce CVE-2026-48356

EUVD-2026-44420 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-14 adobe

GHSA-p3ch-8535-fp8j

File Upload RCE Adobe Adobe Commerce Adobe Commerce B2B Magento Open Source Adobe Commerce Webhooks Plugin

9.3

CVSS 3.1 · NVD

Severity by source

Vendor (adobe) PRIMARY

CRITICAL

qualitative

NVD

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Network-reachable upload with low complexity and no attacker auth (PR:N), but requires victim interaction (UI:R); browser-context execution crosses into the victim session (S:C) with high C/I and no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 21, 2026 - 22:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 21, 2026 - 22:26 vuln.today

cvss_changed

CVSS changed

Jul 21, 2026 - 22:26 NVD

9.6 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 20:55 vuln.today

CVE Published

Jul 14, 2026 - 19:44 nvd

CRITICAL 9.6

DescriptionNVD

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Articles & Coverage 1

News Critical Unrestricted File Upload RCE in Adobe Commerce & Magento - CVE-2026-48356 Jul 15, 2026

AnalysisAI

Arbitrary code execution in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin lets a remote attacker run script in the context of a victim's authenticated session by abusing an unrestricted file-upload flaw (CWE-434). Because the impact executes in the current user's browser/session context and requires the victim to visit a crafted URL or compromised page, the outcome is account/session takeover and privilege escalation rather than direct server compromise. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the EPSS score of 28.32% (98th percentile) signals meaningfully elevated exploitation likelihood for a newly disclosed flaw.

Technical ContextAI

Adobe Commerce (formerly Magento) is a PHP-based e-commerce platform; Magento Open Source is its free edition, Adobe Commerce B2B adds enterprise wholesale functionality, and the Webhooks Plugin extends event-driven integrations. The CPE set (cpe:2.3:a:adobe:adobe_commerce, adobe_commerce_b2b, magento_open_source, adobe_commerce_webhooks_plugin) confirms the flaw spans the core product plus two extensions. The root cause is CWE-434, Unrestricted Upload of File with Dangerous Type: an upload handler fails to adequately validate file type/extension/content, allowing a dangerous file (e.g., an HTML/script payload) to be stored and later served or rendered. Notably, although Adobe labels the outcome 'arbitrary code execution,' the description ('inject malicious scripts into a web page,' victim must visit a URL) and the CVSS metrics (C:H/I:H but A:N, Scope:Changed) indicate execution in the browser/session context - behaviorally closer to stored/reflected script injection than to server-side native code execution.

RemediationAI

Apply the vendor-released July 2026 patches per Adobe APSB26-73 (https://helpx.adobe.com/security/products/magento/apsb26-73.html): upgrade Adobe Commerce to 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, or 2.4.4-2026-jul as matching your branch; upgrade Magento Open Source to 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul; upgrade Adobe Commerce B2B to 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, or 1.3.3-2026-jul; and upgrade the Adobe Commerce Webhooks Plugin to 1.21.0. If immediate patching is not possible, apply compensating controls: place the storefront/admin behind a WAF rule set to block uploads of executable/HTML/script content types and enforce strict extension allow-listing on upload endpoints (trade-off: may block legitimate rich-media or B2B bulk uploads); restrict and monitor access to file-upload features and the Webhooks Plugin routes (trade-off: reduced integration functionality); and set a restrictive Content-Security-Policy and serve user-uploaded files from a sandboxed, non-executing domain with Content-Disposition: attachment to neutralize browser-context script execution (trade-off: may break inline rendering of legitimate uploaded media). Verify the fix version applied against the exact branch in your deployment.